In the field of global positioning systems, the term “integrity” means on the one hand a capability of the global navigation system to warn its users within predetermined time periods if the system or parts of the system, such as e.g. one or more satellites and/or one or more ground stations, should not be relied on, e.g. because of a detected failure thereof, and on the other hand, the term “integrity” is commonly used as a term relating to the trust a user can have with respect to the reliability of the information received from the system or parts of the system, such as e.g. from one or more satellites and/or from one or more ground stations, in particular the accuracy of the information, and/or the reliability of results such as position information determined from the information received from the system.
In known satellite-based global navigation systems such as e.g. GPS and planned satellite-based global navigation systems such as e.g. Galileo, the space vehicles such as e.g. satellites are monitored by themselves and/or by one or more ground stations (also referred to as GSS) in order to detect failure operations of the space vehicles which could affect the accuracy and/or the reliability of the information received from the space vehicles. For example, if it is detected that a specific single satellite is having a failure or cannot provide accurate and/or reliable information for another reason, it is required to issue a warning in case the signals disseminated from this specific satellite (i.e. a single satellite signal), which can be used for navigation and/or determination of a position, contains defects or errors. Such defects may have an influence on the apparent rung length of the signal from the satellite to a receiver and, therefore, may have a strong impact on the accuracy of determined positioning information which is determined from the signals received from the satellites of the global positioning system on the basis of run length of the signal and position of the sending satellite, in this context, also time errors can be considered as run length errors. Such defects or errors are generally referred to as a signal-in-space error (generally abbreviated as SISE). The term “signal-in-space” comes from the task of a global navigation system based on space vehicles, such as e.g. satellites or a satellite navigation system which disseminate signals in space generated at space vehicles to allow a determination of the position of a receiver which receives the signals from the space vehicles.
As mentioned above, the term “integrity” is commonly used in the field space vehicle based global positioning systems (i.e. global navigation systems) and refers to a measure of trust that can be placed by a user or Application in the correctness and reliability of information provided by the navigation system or determined from the information provided by the navigation system. This is necessary since safety-critical applications such as e.g. determining positions in connection with landing and starting of airplanes or other safety-critical applications require an integrity measure in order to be able to determine with which level of confidence the navigation information determined from the signals received from the global positioning systems may be used for the safety-critical application.
The integrity risk IR is defined as a probability that a positional error exceeds a certain tolerance such as a predetermined error magnitude threshold without being detected and without an alert being issued in time (e.g. within a predetermined time period). Such an integrity risk IR is then used by a user or an application as an integrity performance indicator. For example, the user or the application can refrain from using position information determined from signals received from the global positioning system if the determined integrity risk IR is larger than a predetermined integrity risk threshold, where the integrity risk threshold may depend on the requirements of the user and/or the application.
Furthermore, there are known two different scenarios for determining such integrity indicating parameters as the integrity risk IR and/or the protection level PL, wherein the users may either determine the integrity indicating parameter according to a receiver autonomous algorithm (generally referred to RAIM abbreviation for receiver autonomous integrity monitoring), by using external integrity data sources, such as for example the SBAS systems, or by using integrity data which is provided already within the navigation message.
With regard to the above-described different concepts and scenarios for determining integrity indicating parameters, such as the integrity risk IR or the protection level PL, it is to be noted that the existing systems such as GPS (combined with data from SBAS) generally make use of the protection level concept, while the currently planned global positioning system Galileo intends to make use the integrity risk at the alert limit as the integrity indicating parameter. Based on the used concept, different parameters may be required as input parameters. While it is generally possible to estimate the integrity of the system according to both concepts, the results of the different concepts cannot be easily compared directly and it is also preferable to have an algorithm in the future which makes it possible to easily and efficiently calculate both, e.g. protection level as well as the integrity in order to make it advantageously possible to compare results of the different concepts easily.
For the current algorithms discussed for integrity risk determination in the Galileo system, there has been proposed a general algorithm in the article “The Galileo Integrity Concept” by Veit Oehler at al., published in the proceedings of the ION GNSS, 2004; 17th International Technical Meeting of the Satellite Division, Sep. 21-24, 2004, Long Beach, Calif., USA. Regarding the intended Galileo integrity concept as described in the above-mentioned article, please also refer to patent application publication WO 2006/032422 A1 which is directed to the intended Galileo integrity concept as described in the above-mentioned article. According to the Galileo integrity concept, a user can determine an individual integrity risk value by taking into account the received integrity information parameters which comprise the signal-in-space accuracy SISA, the signal-In-space monitoring accuracy SISMA, and the integrity flag IF for each of the space vehicles from which the user receives position information signals for determining a position. It is to be noted that the integrity risk determination algorithm as described in WO 2006/032422 A1 only relates to the determination of an integrity risk IR at a given alert limit AL.
In the following, the currently intended Galileo integrity risk determination concept will be briefly described. For details thereof, please refer to the article “The Galileo Integrity Concept” by Veit Oehler et al, or WO 2006/032422 A1. For the determination of the integrity risk IR at a given alert limit AL, according to the currently planned Galileo integrity concept, there has to be provided integrity information parameters to the user such as the so-called signal-in-space accuracy (abbreviated as SISA), the so-called signal-in-space monitoring accuracy (abbreviated as SISMA), and a so-called integrity flag (the integrity flag for a satellite indicates either “OK” or “not OK”/“don't use” or possibly also “not monitored” for indicating if the signal from a satellite can be used or not)
The signal-in-space accuracy SISA indicates a prediction of a minimum standard deviation of a Gaussian distribution that over-bounds the distribution of the signal-in-space error SISE in case of a fault-free signal-in-space SIS (fault-free indicates that no error and no non-nominal operation such as e.g. a fault condition or failure operation is detected for any of the space vehicles). The signal-in-space monitoring accuracy SISMA corresponds to the minimum standard deviation of a Gaussian distribution which over-bounds the difference between the signal-in-space error SISE, which cannot be measured directly, and the estimated signal-in-space error eSISE, which is estimated from measurements. The integrity flag IF is handled such that the integrity flag for a satellite is set to “not OK” or “don't use” in case the estimated signal-in-space error eSISE for a signal-in-space SIS of a space vehicle is larger than the integrity flag threshold value for this signal-in-space SIS. The integrity flag threshold can be computed from the SISA, SISMA, and a probability of an allowed false alert probability.
According to the Galileo integrity concept as described in WO 2006/032422 A1, an overall integrity risk IR is determined as a sum of various partial integrity risks. First of all, the overall determined integrity risk IR can be separated into two contributions. A first contribution comes from the assumption of an occurrence of a single failure event which is defined as an event in which exactly one of the plurality of space vehicles is in an abnormal condition (i.e. non-nominal condition), also referred to as a faulty condition, in which the signal disseminated from the faulty space vehicle does not exhibit the required accuracy. Partial integrity risks relating to the occurrence of a single space vehicle failure event (also referred to as e.g. a single-SIS fault feared event, a single-SIS event or single-SIS HMI event; HMI for hazardous misleading information) are determined for each available space vehicle (because each available space vehicle could be the faulty space vehicle in a single failure event). Partial integrity risks relating to a single failure event are commonly denoted with a sub-script F such as e.g. IRF. For each space vehicle in each positional domain X (X can be one of the directions of three-dimensional Cartesian or spherical coordinates, or only one of two positional domains such as vertical and horizontal; horizontal including two degrees of freedoms in a horizontal plane).
The integrity risk for the single failure event of a certain space vehicle sat in a certain positional domain X is herein labeled IRsat,F,X.
The partial integrity risk IRF,X associated to the occurrence of a single failure event in a certain positional domain X is, then, given by the sum over all available space vehicles (e.g. the number N) used for positioning, i.e. from which space vehicles position information is received and used for the determination of a position, of the partial integrity risks associated to each of these space vehicles in this certain positional domain X as given in formula (1) below;
                              IR                      F            ,            X                          =                              ∑                          sat              =              1                        N                    ⁢                      IR                          sat              ,              F              ,              X                                                          (        1        )            
Here, the integrity risk IRF,X indicates the integrity risk related to the occurrence of a single failure event in the certain positional domain X obtained by a sum over partial integrity risks IRsat,F,X for each single space vehicle sat. It is to be noted that the sum is determined due to the fact that the integrity risks relate to estimations of probabilities so that the integrity risk IRF,X may be regarded as an estimate of probability that exactly one of the plurality of available space vehicles is in an abnormal or faulty condition and the error exceeds the tolerance in the positional domain X. It is given by the sum of an estimate of the corresponding probability of a single failure event for each of the specific space vehicles sat represented by IRsat,F,X.
The overall integrity risk relating to the occurrence of a single failure event is then given by a sum over all positional domains X (here, e.g. for the two positional domains vertical V and horizontal H; horizontal including two degrees of freedom) as illustrated in equation (2):
                              IR          F                =                                            ∑                                                X                  =                  V                                ,                H                                      ⁢                          IR                              F                ,                X                                              =                                    ∑                              ∀                X                                      ⁢                                          ∑                                  sat                  =                  1                                N                            ⁢                              IR                                  sat                  ,                  F                  ,                  X                                                                                        (        2        )            
For the determination of the overall integrity received IR, there is further considered a second contribution relating to a so-called “fault-free” feared event which corresponds to the assumption that non of the plurality of space vehicles is in a abnormal or faulty condition so that there is no single failure event, however, the small errors or error-fluctuations of the signals disseminated by the plurality of space vehicles still statistically lead to an overall positional error in the position determination based on the position information received from the plurality of space vehicles that exceeds a certain tolerance.
Also in this case, especially since there is no single failure event, no alarm of alert would be issued although the overall positional error exceeds the tolerance. For this reason, such a failure-free event is also considered in the integrity risk determination and contributes to the overall integrity risk to be determined. Integrity risk parameters relating to the assumption of a fault free event are generally labeled with the subscript N for nominal or normal such as e.g. IRN. In general, there can also be determined a partial integrity risk relating to the fault-free event for each different positional domain X, which is generally labeled as IRN,X. Then, the overall integrity risk IRN relating to the fault-free condition is given by the sum over all integrity risks IRN,X for each positional domain X. Here, as well as above in formula (2), the positional domains X can be, for example vertical V and horizontal H or also the three positional domains such as Cartesian coordinates x, y, z or spherical coordinates. Here, z of the Cartesian coordinates or the radial component of the spherical coordinates may correspond to the single degree of freedom corresponding to vertical V domain and x, y of the Cartesian coordinates or the two angular components of the spherical coordinates (such as e.g. longitude and latitude) may correspond to the two degrees of freedom of the horizontal positional domain H. However, it is to be noted that WO 2006/032422 A1 only considers an algorithm for two positional domains vertical V and horizontal H. Integrity risk determination in three one-dimensional positional domains is not considered in WO 2006/032422 A1.
The overall integrity risk IR is, then, determined by the sum of the integrity risks IRF relating to the single failure condition, and IRN relating to the fault-free condition.
For example, the following equation (3) shows the formula for the calculation of the overall integrity risk IR according to the basic Galileo integrity concept as described in the above mentioned article and WO 2006/032422 A1. Here, the integrity risk IR is labeled as PHMI for indicating that it relates to an estimate of the probability of the occurrence of hazardous misleading information:
                                          P            HMI                    ⁡                      (                          VAL              ,              HAL                        )                          =                ⁢                                            P                              IntRisk                ,                V                                      +                          P                              IntRisk                ,                H                                              =                    ⁢                      1            -                          erf              ⁡                              (                                  VAL                                                            2                                        ⁢                                          σ                                              u                        ,                        V                        ,                        FF                                                                                            )                                      +                                                            ⅇ                                      -                                                                  HAL                        2                                                                    2                        ⁢                                                  ξ                          FF                          2                                                                                                                    ++                            ⁢                              1                2                            ⁢                                                ∑                                      j                    =                    1                                                        Nsat                    ⁢                    _                    ⁢                    Galileo                                                  ⁢                                                                                                    P                                                  fail                          ,                                                      sat                            j                                                                                              (                                                                                          ⁢                                                                        (                                                      1                            -                                                          erf                              ⁡                                                              (                                                                                                      VAL                                    +                                                                          μ                                                                              u                                        ,                                        V                                                                                                                                                                                                                        2                                                                        ⁢                                                                          σ                                                                              u                                        ,                                        V                                        ,                                        FM                                                                                                                                                                            )                                                                                                              )                                                +                                                  (                                                      1                            -                                                          erf                              ⁡                                                              (                                                                                                      VAL                                    -                                                                          μ                                                                              u                                        ,                                        V                                                                                                                                                                                                                        2                                                                        ⁢                                                                          σ                                                                              u                                        ,                                        V                                        ,                                        FM                                                                                                                                                                            )                                                                                                              )                                                                    )                                        ++                                    ⁢                                                            ∑                                              j                        =                        1                                                                    Nsat                        ⁢                        _                        ⁢                        Galileo                                                              ⁢                                                                  P                                                  fail                          ,                          sat                                                                    ⁡                                              (                                                  1                          -                                                                                    χ                                                              2                                ,                                                                  δ                                  a                                                                ,                                H                                                            2                                                        ⁢                                                          cdf                              ⁡                                                              (                                                                                                      HAL                                    2                                                                                                        ξ                                    FM                                    2                                                                                                  )                                                                                                                                    )                                                                                                                                                    (        3        )            
As can be seen from equation (3), the integrity risk IR depends on input parameters such as the vertical alert limit VAL and the horizontal alert limit HAL (in case of the prior art of WO 2006/032422 A1, the positional domains are only vertical V and horizontal H), where the overall integrity risk IR is given by a sum of contributions from the vertical positional domain, herein labeled as PintRisk,V, and from the horizontal positional domain, herein labeled as PintRisk,H.
The terms on the right hand side of the second equal sign of the first line of equation (3) relates to contributions to the overall integrity risk which relate to the fault-free condition or fault-free event, i.e. to the assumption that none of the plurality of space vehicles is in an abnormal or faulty condition. The second and third of the lines of equation (3) above relate to contributions to the overall integrity limit from the assumption of a single failure event which is indicated by the fact that the second and the third line of equation (3) above comprise sums over the plurality of space vehicles (here, the number of available space vehicles is indicated by Nsat—Galileo). The second line in equation (3) above relates to the single fault event contribution relating to the vertical positional domain as indicated by the fact that the parameter of the vertical alert limit VAL is introduced in this line as well as the fact that the second line of equation (3) is based on a one-dimensional Gaussian distribution indicating that it relates to a single degree of freedom, i.e. the vertical direction.
The third line in equation (3) above relates to the contributions to the overall integrity risk from the occurrence of a single failure event in the horizontal positional domain which is indicated by the fact that the third line of equation (3) depends on the horizontal alert limit parameter HAL and involves a chi-squared function with two degrees of freedom indicating the two degrees of freedom of the horizontal a positional domain.
As can be, for example, derived from the second line of equation (3) above, the contribution to the overall integrity risk IR from the vertical positional domain according to the algorithm of WO 2006/032422 A1 involves contributions relating to the single failure event which are determined based on two probabilities, namely a probability referred to as Pfall,sat—i (in the following referred to as Psat,OC,F) which indicates a probability for the occurrence of a single failure event, and a probability, which is given by the factor of ½ and the content of the bracket in the second line of equation (3) indicating a probability of an impact of the occurrence of the occurred single failure event to the positional error of the positioning information determination in the vertical positional domain (here, the vertical positional domain as indicated by the vertical alert limit VAL, this probability relating to the impact will be labeled in the following as Isat,F,X). The third line in equation (3) above relates to the contributions from the horizontal domain.
Accordingly, the partial integrity risk IRsat,F,X relating to the single failure event of a certain space vehicle sat in a certain positional domain X according to the algorithm of WO 2006/032422 A1 is given by the below formula (3a):IRsat,F,X=Psat,OC,F·Isat,F,X└ξ=Tsat,σID(σUERE,σSISMA,sat,σSISA,all-sat),kX,lX┘  (3a)
In the above formula (3a), according to the algorithm of WO 2006/032422 A1, the parameter Psat,OC,F indicates an upper bound of an estimate of the probability of a occurrence of a single failure event and the term Isat,F,X indicates the probability of an impact of the single failure event on the certain positional domain X in the faulty condition. As indicated in equation (3a) above, the term Isat,F,X is a function of the so-called detection threshold Tsat which is given according to the formula (4):Tsat=kfa√{square root over (σSISA,sat2+σSISMA,sat2)}  (4)
The detection threshold Tsat can be calculated from a constant kfa, which is related to the probability of a false alarm, the signal-in-space accuracy SISA relative to the space vehicle sat (herein labeled σSISA,sat), and the signal-in-space monitoring accuracy SISMA relative to the space vehicle sat (herein labeled as σSISMA,sat).
Furthermore, the term Isat,F,X is a function of a standard deviation σX of the positional error in the positional domain X, in the case of a one-dimensional error also labeled as σ1D. The standard deviation σX of the error in a certain positional domain X is a function of the standard deviation σUERE of the user equivalent range error, the signal-in-space accuracy σSISA,sat and the signal-in-space accuracy of all the space vehicles used in the positioning determination except the space vehicle sat which signal-in-space accuracy is labeled as σSISA,all,sat. Furthermore, the term Isat,F,X is a function of a parameter kX which describes the parameter relevant for the transformation from range to the positional domain X and the error magnitude IX in the certain positional domain X relating to a position error threshold in the certain a positional domain X.
Summarizing, the determination of the integrity risk IR according to the basic Galileo integrity risk determination algorithm as described in WO 2006/032422 A1 introduces approximations that lead to biased estimations of the integrity risk IR for the assumption of single failure events (e.g. a faulty condition). This typically leads to very conservative results since the determination is based on the two contributions relating to the determination of an upper bound of a probability of an occurrence of the single failure event and an estimate of the probability of impact of the single failure event on the positional domain X. Here, conservative approximation means that the estimated integrity risk is estimated larger than necessary. Although this might be acceptable in terms of safety, it is disadvantageous with regard to the availability of the system since users and applications might refrain from using position information determined from signals received from the global positioning system when the conservatively determined integrity risk already exceeds a predetermined threshold indicating the requirements of the user or the application although the actual integrity of the global positioning system is still compliant with these requirements of the user or the application. However, for global positioning systems such as Galileo and GPS, it is necessary to provide a system which has high integrity as well as high continuity and high availability at the same time. Moreover, the algorithm as described WO 2006/032422 A1 still involves complex computational efforts in the determination of the integrity risk.
In general, it is preferable to provide a method and an apparatus for determining an integrity indicating parameter which indicates the integrity of positioning information determined from positioning information signals disseminated from a plurality of space vehicles of a global positioning system which has high integrity, high continuity, and high availability at the same time. It is therefore preferable to provide a method and an apparatus for determining an integrity indicating parameter according to an algorithm which allows to increase at least one of continuity, integrity, and availability compared to the algorithms as known from the prior art. In addition, it is also preferable to provide a method and an apparatus for determining an integrity indicating parameter such that the computational effort is reduced compared to the algorithms as known from the prior art, so that the integrity indicating parameter can be preferably calculated easily and with reduced computational burdens allowing to efficiently determine the integrity indicating parameter at a receiver of a user in real time locally for each single user or application. Moreover, it is preferable to provide a method and an apparatus for determining an integrity indicating parameter, wherein an integrity risk as well as a protection level can be determined as the integrity indicating parameter so as to allow an efficient possibility for comparison of the two known concepts of integrity, i.e. integrity risk based concepts and protection level based concepts.